Critical Plex Media Server update patches undisclosed flaws: update to v1.43.3 now

Plex has issued a security advisory urging all users to update their media server instances immediately, following the discovery and patching of multiple undisclosed vulnerabilities. The fixes are in Plex Media Server version 1.43.3 and Plex Desktop 1.115.0. Plex hasn’t publicly detailed the specific mechanics of these flaws, but has confirmed that CVE identifiers have been requested and are pending assignment.

Given Plex’s history as a target for threat actors, and the sheer number of internet-facing instances out there, delaying this update puts your home lab or enterprise infrastructure at real risk. Here’s the technical context behind the update, the exploit chains behind recent Plex vulnerabilities, and what to actually do about it.

The latest patch, and what it means for NAS users

Plex’s message is simple: update now. Silent patches like this one usually mean the underlying issue is serious, something like remote code execution (RCE) or an authentication bypass severe enough that developers want it fixed before the details go public.

On Windows, macOS, or Linux, you can typically pull the update through Plex’s built-in updater or your standard package manager. NAS users face a bigger hurdle: Plex has noted that the updated package may not yet be available through native NAS package managers like Synology Package Center or QNAP App Center.

If you’re running Plex on a NAS, don’t wait for the package manager to catch up. Download the installation package for your NAS architecture (ARM or x86_64) directly from the official Plex downloads page and install it manually through the NAS control panel. Docker users should pull the latest plexinc/pms-docker image and recreate their container so both the OS and the Plex binaries are fully patched.

Technical deep dive: the August 2025 exploit chain (CVE-2025-34158)

The most recent flaw Plex patched shows the kind of vulnerability that keeps turning up on this platform. In August 2025, Plex fixed a high-severity authentication and authorization flaw tracked as CVE-2025-34158, with a CVSS score of 8.5.

The vulnerability came down to broken access control and improper privilege management in the Plex API. The /myplex/account endpoint was misconfigured and exposed the server owner’s account details to anyone. Worse, that same endpoint leaked the administrative access token, often called the X-Plex-Token, to any authenticated user, regardless of their privilege level.

From token leakage to infrastructure discovery

For context: an access token is basically a digital master key that proves your identity to Plex’s servers without needing your password. If a lower-privileged user, say a family member or a friend you shared your server with, can steal this token, they effectively become the administrator.

For security professionals, this flaw chains into two steps that expose your whole infrastructure:

1. Token extraction (privilege escalation): An authenticated, non-owner user sends a GET request to the /myplex/account endpoint. With no proper role-based access control on the backend, the server returns a JSON payload containing the owner’s admin token.
2. Resource enumeration (information disclosure): With the stolen admin token, the attacker swaps in the owner’s credentials and queries the /api/resources endpoint, which returns a full list of servers, libraries, and network resources tied to that account.

Chaining these two calls, an attacker with minimal privileges could map out the target’s entire Plex setup, spot other exposed servers, and pivot toward less-secured devices on the same network.

http

# Step 1: Extracting the Admin Token (Simulated)
GET /myplex/account HTTP/1.1
Host: [YOUR_PLEX_IP]:32400
X-Plex-Token: [LOW_PRIVILEGE_USER_TOKEN]
Accept: application/json
# Response includes the admin token in the JSON payload
{
  "user": {
    "id": 12345678,
    "username": "admin_user",
    "authToken": "STOLEN_ADMIN_ACCESS_TOKEN", 
    ...
  }
}
# Step 2: Enumerating Infrastructure using the stolen token
GET /api/resources?includeHttps=1&includeRelay=1 HTTP/1.1
Host: [YOUR_PLEX_IP]:32400
X-Plex-Token: STOLEN_ADMIN_ACCESS_TOKEN
Accept: application/json

Attack surface: the reality of internet-facing instances

These API vulnerabilities matter more because Plex has such a large attack surface to begin with. Data from Censys, an internet-wide scanning engine, shows more than 360,000 devices currently exposing the Plex Media Server web interface directly to the public internet.

Exposure and vulnerability aren’t the same thing, though. Not all 360,000 of those instances are open to unauthenticated remote code execution, since Plex requires authentication for most critical endpoints. But the August 2025 flaw shows a different kind of danger: it only required low-level authentication. If you share your Plex server with anyone outside your household, or if your credentials have shown up in an unrelated data breach, your instance is squarely in reach of this token-leakage exploit chain.

Exposing your media server directly to the WAN without a reverse proxy or web application firewall also leaves the API open to automated scraping, brute-force attempts, and zero-day exploitation the moment a patch gets reverse-engineered.

Why Plex is a high-value target

Plex servers have been used for more than stealing media: they’ve served as a way into much bigger networks. Two past incidents make the case for patching quickly.

The LastPass breach pivot (CVE-2020-5741)

The best-known example of Plex-related collateral damage happened in August 2022, when LastPass suffered a major breach. The initial intrusion was traced back to a Plex Media Server vulnerability (CVE-2020-5741, CVSS 7.2). Attackers used the flaw to compromise a LastPass developer’s home network through their personal Plex server, then deployed keylogger malware that eventually captured the developer’s master password, and pivoted from there into LastPass’s corporate environment.

This shows how a “minor” flaw in a home media server can end up causing an enterprise-level breach.

UDP reflection and amplification (2021)

Before that, in February 2021, Plex issued an emergency hotfix (v1.21.3.4014) for a flaw that let attackers use exposed servers for UDP reflection attacks. Attackers could send spoofed UDP packets to a Plex server and have it “reflect” traffic toward a victim, amplifying a DDoS attack. The fix restricted UDP responses to the local network only, blocking WAN-based reflection attempts.

Securing your Plex instance, step by step

Updating to 1.43.3 is the minimum. Real security means a few layers of defense on top of that.

1. Update immediately

• Windows/Mac/Linux: Open Plex Media Server, go to Settings, and check for updates, or grab the installer from the Plex website directly.
• NAS (Synology/QNAP): Download the manual package from the Plex website, then use “Manual Install” in your NAS Package Manager to upload the .spk or .qpkg file.
• Docker: Run docker pull plexinc/pms-docker:latest and recreate your container, making sure your configuration volumes stay correctly mapped so you don’t lose data.

2. Put Plex behind a reverse proxy

Avoid exposing Plex directly to the internet via port forwarding (port 32400) if you can. Put it behind a reverse proxy instead, like Nginx Proxy Manager, Traefik, or Caddy.

• Benefits: hides your real IP address, lets you enforce HTTPS with valid certificates, and gives you one place to apply rate limiting and IP whitelisting.
• Action: configure the proxy to only allow trusted IP ranges, or add another layer of authentication (Authelia, Authentik) before traffic even reaches the Plex login screen.

3. Disable remote access if you don’t need it

If you only ever use Plex on your home Wi-Fi, turn off “Remote Access” in the Plex settings entirely. That keeps port 32400 closed to the outside world and takes internet-facing API exploits off the table.

4. Audit shared and managed users

Since recent vulnerabilities have relied on low-privileged users to escalate access, it’s worth checking who actually has access to your server. Remove anyone who doesn’t need it anymore. For kids or guests, use Plex’s “Managed Users” feature: it limits them to specific libraries and keeps them out of server-wide settings and account details.

5. Watch your logs for unusual API activity

If you’re comfortable digging into logs, check Plex Media Server.log for repeated requests to /myplex/account or /api/resources coming from IPs that don’t match your known devices. If you’re running behind a reverse proxy, your Nginx or Traefik access logs are worth checking too for odd enumeration patterns.

The bottom line

Plex Media Server 1.43.3 and Plex Desktop 1.115.0 patch several vulnerabilities the company hasn’t detailed publicly yet. Given the track record here (CVE-2025-34158, the LastPass pivot, the 2021 UDP reflection bug), that’s not a reason to wait around for more details. Update now, patch your NAS manually if the package manager hasn’t caught up yet, and put a reverse proxy and real access controls in front of anything still facing the internet.